Agents that don't wait for you to ask: the price of privacy and of compute
This post was originally published in Portuguese on my blog: Agentes que não esperam você pedir: o preço da privacidade e da computação. For years, an AI assistant was something that sat waiting for you to type. You ask
This post was originally published in Portuguese on my blog: Agentes que não esperam você pedir: o preço da privacidade e da computação.
For years, an AI assistant was something that sat waiting for you to type. You ask, it answers, done. The shift happening now is different: agents that stay on all the time, look at your inbox, learn your goals and go off doing things without anyone asking. In theory that's great. In practice, it opens a conversation that those of us working in tech need to have before granting access to everything.
What happened
At DevDay on September 29, OpenAI introduced "Dots", agents it describes as always on. Each one has its own cloud computer, with a browser, and connects to thousands of apps through plugins. You can talk to it through ChatGPT or through Slack and Teams, and it runs several projects in parallel. The first Dot is included in the Pro and Business Premium plans, and on the Pro plan the feature hasn't yet reached the European Economic Area, Switzerland and the UK.
There's a layer of control: rules for when to act alone and when to ask, custom rules to allow, block or require approval for specific actions, and an automatic review before anything that touches accounts or shares information. Changing a password, for example, is still the user's job. OpenAI itself warns that the agent can make mistakes and that all important work needs human review.
This week, Fortune tied together two threads that usually run separately in this discussion: privacy and the cost of compute.
The price of privacy
According to the report, Meredith Whittaker, president of Signal, has been warning that personal agents need deep access to your data to work, and that creates security and privacy risk. The point that struck me most is about consent: whoever sends an email or message to a person using one of these agents never agreed to have an AI read it. The access you grant carries along the correspondence of everyone you talk to.
OpenAI's own head of developer experience, Romain Huet, suggests gradual trust: start with the calendar and only later open up Slack and Gmail. He says he lets his Dot categorize emails and draft replies, but never send messages on his behalf. It's sensible advice, and it applies to any agent, from any company.
The price of compute
An always-on agent costs more than a chatbot. An OpenAI executive admitted that Dots are "compute heavy", and the company already routes part of the work to a smaller model, Terra, which according to OpenAI delivers even better results on some tasks, like computer use and writing, at a tenth of the price. On the side of those paying the bill, Fortune cites Menlo Ventures data: companies spent US$ 177 billion on AI in the 12 months through September, more than five times the previous period, and spent well above what they had budgeted. It also reports that Apple lowered the daily AI spending cap for some engineers from US$ 300 to US$ 200.
Why this matters if you work in tech
- Permissions become an architecture decision. Whoever integrates agents with internal systems will need to think about least privilege, separate credentials, an audit trail and a way to pause everything. It's the same reasoning as for any service account, except this account now takes initiative.
- Cost becomes part of the design. If the agent runs all day, the token budget stops being an end-of-project detail. Routing between large and small models will likely become common practice.
- Privacy is about third parties too. In a country with a data protection law like Brazil's LGPD, delegating email and chat reading to an agent means looking at what that implies for clients and colleagues, not just for you.
My take
I find the idea promising and the moment still immature. The technical side is evolving fast, but usage habits are still in "allow everything and see what happens" mode. I'd treat an agent like this the way I'd treat a very fast intern: start with read access to a few things, approve what it does before it leaves the building, and only expand trust with evidence. And I'd pay attention to what the vendor doesn't answer clearly, especially about what happens to the data of people who aren't your users.
It's also worth being wary of collective enthusiasm. When the cost is still being subsidized and the access rules change every quarter, any critical process relying on an agent needs a plan B. Use it, yes. Blind dependence, no.
Sources:
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.